CVE-2025-52688CWE-77

Command Injection Vulnerability in the OmniAccess Stellar Web Management Interface

Critical · published July 16, 2025

CVSS v3.1
9.8
EPSS
37%
Percentile
98.5
In the wild
Unconfirmed
What it is

🚨 An attacker could potentially gain root access to the access point with just a crafty command injection! 🔥 Think of this as leaving your front door wide open at night, inviting anyone to stroll in uninvited. Without the right locks (or checks), anyone can take control and wreak havoc inside your home (or network). The consequences are absolutely devastating. An attacker could not only access sensitive data but also manipulate the entire access point, compromising the confidentiality, integrity, and availability of your network. Imagine losing complete control of your internet access — that's a nightmare scenario!

Put simply

Think of this as leaving your front door wide open at night, inviting anyone to stroll in uninvited. Without the right locks (or checks), anyone can take control and wreak havoc inside your home (or network). This vulnerability allows attackers to inject commands with root privileges on the access point, bypassing security measures and gaining full control over the device.

What to do

The consequences are absolutely devastating. An attacker could not only access sensitive data but also manipulate the entire access point, compromising the confidentiality, integrity, and availability of your network. Imagine losing complete control of your internet access — that's a nightmare scenario! Immediate action is essential! First, patch your access points to the latest firmware version that addresses this vulnerability. Additionally, review your network configuration to ensure best practices for securing your access points are in place. You've got this! Follow these steps, and you'll be back in control in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.37118 · 98.5th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-07-16T06:23Z
EPSS history
Timeline
  • 16 JUL 06:23Z
    Command Injection Vulnerability in the OmniAccess Stellar Web Management Interface
    cvelistv5